{"id":"CVE-2026-49762","aliases":["AZL-89672","DEBIAN-CVE-2026-49762","EEF-CVE-2026-49762","EUVD-2026-35439","GHSA-w2h8-8x3g-278p","OESA-2026-2787","UBUNTU-CVE-2026-49762"],"status":"published","title":"Unbounded integer parsing in the Version module enables CPU and memory exhaustion denial of service","description":"Uncontrolled Resource Consumption vulnerability in the Elixir standard library's Version module allows an attacker who controls a version string to cause a denial of service through CPU and memory exhaustion.\n\nThe version parser converts numeric version components (major, minor, patch and numeric pre-release/build identifiers) to integers without bounding their length. A single large all-digit component therefore forces a super-linear, non-yielding base-10 to arbitrary-precision integer conversion (String.to_integer/1, i.e. :erlang.binary_to_integer/1) that pins a BEAM scheduler, and a larger component raises an uncaught SystemLimitError that crashes the calling process. A single moderately sized string (around one megabyte) is enough; no authentication is required.\n\nThis is reachable from the public entry points Version.parse/1, Version.parse!/1, Version.match?/3, Version.compare/2, and Version.parse_requirement/1, which applications routinely call on untrusted input such as HTTP parameters, dependency-manifest fields, and package metadata.\n\nThis vulnerability is associated with program files lib/version.ex and program routines 'Elixir.Version.Parser':parse_digits/2.\n\nThis issue affects elixir: from 0.9.3 before 1.20.1.","severity":{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00152,"percentile":0.04396,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2026-06-09T14:04:07Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Azure Linux:3","package":"elixir","fixed_in":["1.16.1-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"elixir-lang","fixed_in":["1.20.1.dfsg-1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"elixir","fixed_in":["1.12.0-2.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"elixir","fixed_in":["1.14.4-3.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"elixir","fixed_in":["1.14.4-3.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"elixir","fixed_in":["1.9.0-2.oe2003sp4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"elixir","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.1-2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"elixir-lang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.14.0.dfsg-2","1.17.3.dfsg-1","1.17.3.dfsg-2","1.18.1.dfsg-1","1.18.1.dfsg-1.1","1.18.3.dfsg-1","1.18.3.dfsg-2","1.19.5.dfsg-1","1.19.5.dfsg-2","1.20.0.dfsg-1","1.20.1.dfsg-1","1.20.1.dfsg-2","1.20.4+dfsg-1"]},{"source":"osv","ecosystem":"Debian:13","package":"elixir-lang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18.3.dfsg-1","1.18.3.dfsg-2","1.19.5.dfsg-1","1.19.5.dfsg-2","1.20.0.dfsg-1","1.20.1.dfsg-1","1.20.1.dfsg-2","1.20.4+dfsg-1"]},{"source":"osv","ecosystem":"Debian:14","package":"elixir-lang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1.dfsg-1"}]}],"versions":["1.18.3.dfsg-1","1.18.3.dfsg-2","1.19.5.dfsg-1","1.19.5.dfsg-2","1.20.0.dfsg-1"]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"elixir","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0-2.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"elixir","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.4-3.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"elixir","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.4-3.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"elixir","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-2.oe2003sp4"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"elixir-lang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.0~0.20150708-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"elixir-lang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.3-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"elixir-lang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.1.dfsg-1","1.9.1.dfsg-1.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"elixir-lang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.3.dfsg-1.1","1.12.2.dfsg-2.1","1.12.2.dfsg-2.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"elixir-lang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.14.0.dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"elixir-lang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18.1.dfsg-1.1","1.18.3.dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"elixir-lang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18.3.dfsg-1build1","1.20.1.dfsg-2ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"elixir-lang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18.3.dfsg-1","1.18.3.dfsg-1build1"]}],"products":[{"vendor":"elixir-lang","product":"elixir"}],"references":[{"url":"https://github.com/elixir-lang/elixir/security/advisories/GHSA-w2h8-8x3g-278p","tags":["related","vendor-advisory","advisory","report"]},{"url":"https://cna.erlef.org/cves/CVE-2026-49762.html","tags":["related","web","report"]},{"url":"https://osv.dev/vulnerability/EEF-CVE-2026-49762","tags":["related","web","report"]},{"url":"https://github.com/elixir-lang/elixir/commit/057691722eb8cfe315f5606358954a2b173ff7a3","tags":["related","fix","web"]},{"url":"https://github.com/elixir-lang/elixir/commit/c64417d72fd5c7d09e963ca3ac5fa2b140978d9e","tags":["patch","fix","report"]},{"url":"https://github.com/elixir-lang/elixir/commit/64e6707233464c3e55a9ca6b44019aed25b0390a","tags":["patch","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49762","tags":["web","advisory"]},{"url":"https://github.com","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49762.json","tags":["advisory"]},{"url":"https://github.com/elixir-lang/elixir","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-49762","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2787","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-49762","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-49762","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-49762","title":"Unbounded integer parsing in the Version module enables CPU and memory exhaustion denial of service","description":"Uncontrolled Resource Consumption vulnerability in the Elixir standard library's Version module allows an attacker who controls a version string to cause a denial of service through CPU and memory exhaustion.\n\nThe version parser converts numeric version components (major, minor, patch and numeric pre-release/build identifiers) to integers without bounding their length. A single large all-digit component therefore forces a super-linear, non-yielding base-10 to arbitrary-precision integer conversion (String.to_integer/1, i.e. :erlang.binary_to_integer/1) that pins a BEAM scheduler, and a larger component raises an uncaught SystemLimitError that crashes the calling process. A single moderately sized string (around one megabyte) is enough; no authentication is required.\n\nThis is reachable from the public entry points Version.parse/1, Version.parse!/1, Version.match?/3, Version.compare/2, and Version.parse_requirement/1, which applications routinely call on untrusted input such as HTTP parameters, dependency-manifest fields, and package metadata.\n\nThis vulnerability is associated with program files lib/version.ex and program routines 'Elixir.Version.Parser':parse_digits/2.\n\nThis issue affects elixir: from 0.9.3 before 1.20.1.","status":"published","published":"2026-06-09T14:04:07.405Z","modified":"2026-10-06T08:35:59.691Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T13:35:10.963527Z"}],"euvd":[{"id":"EUVD-2026-35439","description":"Uncontrolled Resource Consumption vulnerability in the Elixir standard library's Version module allows an attacker who controls a version string to cause a denial of service through CPU and memory exhaustion.\n\nThe version parser converts numeric version components (major, minor, patch and numeric pre-release/build identifiers) to integers without bounding their length. A single large all-digit component therefore forces a super-linear, non-yielding base-10 to arbitrary-precision integer conversion (String.to_integer/1, i.e. :erlang.binary_to_integer/1) that pins a BEAM scheduler, and a larger component raises an uncaught SystemLimitError that crashes the calling process. A single moderately sized string (around one megabyte) is enough; no authentication is required.\n\nThis is reachable from the public entry points Version.parse/1, Version.parse!/1, Version.match?/3, Version.compare/2, and Version.parse_requirement/1, which applications routinely call on untrusted input such as HTTP parameters, dependency-manifest fields, and package metadata.\n\nThis vulnerability is associated with program files lib/version.ex and program routines 'Elixir.Version.Parser':parse_digits/2.\n\nThis issue affects elixir: from 0.9.3 before 1.20.1.","status":"published","published":"2026-06-09T14:04:07Z","modified":"2026-10-06T08:35:59Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T17:27:38.724649Z"}],"nvd":[{"id":"CVE-2026-49762","description":"Uncontrolled Resource Consumption vulnerability in the Elixir standard library's Version module allows an attacker who controls a version string to cause a denial of service through CPU and memory exhaustion.\n\nThe version parser converts numeric version components (major, minor, patch and numeric pre-release/build identifiers) to integers without bounding their length. A single large all-digit component therefore forces a super-linear, non-yielding base-10 to arbitrary-precision integer conversion (String.to_integer/1, i.e. :erlang.binary_to_integer/1) that pins a BEAM scheduler, and a larger component raises an uncaught SystemLimitError that crashes the calling process. A single moderately sized string (around one megabyte) is enough; no authentication is required.\n\nThis is reachable from the public entry points Version.parse/1, Version.parse!/1, Version.match?/3, Version.compare/2, and Version.parse_requirement/1, which applications routinely call on untrusted input such as HTTP parameters, dependency-manifest fields, and package metadata.\n\nThis vulnerability is associated with program files lib/version.ex and program routines 'Elixir.Version.Parser':parse_digits/2.\n\nThis issue affects elixir: from 0.9.3 before 1.20.1.","status":"published","published":"2026-06-09T14:16:44.317Z","modified":"2026-10-06T09:17:56.08Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:12:23.109705Z"}],"osv":[{"id":"CVE-2026-49762","title":"Unbounded integer parsing in the Version module enables CPU and memory exhaustion denial of service","description":"Uncontrolled Resource Consumption vulnerability in the Elixir standard library's Version module allows an attacker who controls a version string to cause a denial of service through CPU and memory exhaustion.\n\nThe version parser converts numeric version components (major, minor, patch and numeric pre-release/build identifiers) to integers without bounding their length. A single large all-digit component therefore forces a super-linear, non-yielding base-10 to arbitrary-precision integer conversion (String.to_integer/1, i.e. :erlang.binary_to_integer/1) that pins a BEAM scheduler, and a larger component raises an uncaught SystemLimitError that crashes the calling process. A single moderately sized string (around one megabyte) is enough; no authentication is required.\n\nThis is reachable from the public entry points Version.parse/1, Version.parse!/1, Version.match?/3, Version.compare/2, and Version.parse_requirement/1, which applications routinely call on untrusted input such as HTTP parameters, dependency-manifest fields, and package metadata.\n\nThis vulnerability is associated with program files lib/version.ex and program routines 'Elixir.Version.Parser':parse_digits/2.\n\nThis issue affects elixir: from 0.9.3 before 1.20.1.","status":"published","published":"2026-06-09T14:04:07.405Z","modified":"2026-10-28T02:31:09.707805316Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:45:07.060148Z"},{"id":"DEBIAN-CVE-2026-49762","description":"Uncontrolled Resource Consumption vulnerability in the Elixir standard library's Version module allows an attacker who controls a version string to cause a denial of service through CPU and memory exhaustion.  The version parser converts numeric version components (major, minor, patch and numeric pre-release/build identifiers) to integers without bounding their length. A single large all-digit component therefore forces a super-linear, non-yielding base-10 to arbitrary-precision integer conversion (String.to_integer/1, i.e. :erlang.binary_to_integer/1) that pins a BEAM scheduler, and a larger component raises an uncaught SystemLimitError that crashes the calling process. A single moderately sized string (around one megabyte) is enough; no authentication is required.  This is reachable from the public entry points Version.parse/1, Version.parse!/1, Version.match?/3, Version.compare/2, and Version.parse_requirement/1, which applications routinely call on untrusted input such as HTTP parameters, dependency-manifest fields, and package metadata.  This vulnerability is associated with program files lib/version.ex and program routines 'Elixir.Version.Parser':parse_digits/2.  This issue affects elixir: from 0.9.3 before 1.20.1.","status":"published","published":"2026-06-09T14:16:44.317Z","modified":"2026-10-07T09:47:26.591548859Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:45:56.444225Z"},{"id":"EEF-CVE-2026-49762","title":"Unbounded integer parsing in the Version module enables CPU and memory exhaustion denial of service","description":"## Summary\n\nUncontrolled Resource Consumption vulnerability in the Elixir standard library's `Version` module allows an attacker who controls a version string to cause a denial of service through CPU and memory exhaustion.\n\nThe version parser converts numeric version components (major, minor, patch and numeric pre-release/build identifiers) to integers without bounding their length. A single large all-digit component therefore forces a super-linear, non-yielding base-10 to arbitrary-precision integer conversion (`String.to_integer/1`, i.e. `:erlang.binary_to_integer/1`) that pins a BEAM scheduler, and a larger component raises an uncaught `SystemLimitError` that crashes the calling process. A single moderately sized string (around one megabyte) is enough; no authentication is required.\n\nThis is reachable from the public entry points `Version.parse/1`, `Version.parse!/1`, `Version.match?/3`, `Version.compare/2`, and `Version.parse_requirement/1`, which applications routinely call on untrusted input such as HTTP parameters, dependency-manifest fields, and package metadata.\n\nThis vulnerability is associated with program files `lib/version.ex` and program routines `'Elixir.Version.Parser':parse_digits/2`.\n\nThis issue affects elixir: from 0.9.3 before 1.20.1.","status":"published","published":"2026-06-09T14:04:07.405Z","modified":"2026-10-06T08:45:03.972347588Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:33.520522Z"},{"id":"OESA-2026-2787","title":"elixir security update","description":"Elixir is a programming language built on top of the Erlang VM. As Erlang, it is a functional language built to support distributed, fault-tolerant, non-stop applications with hot code swapping.\r\n\r\nSecurity Fix(es):\n\nUncontrolled Resource Consumption vulnerability in the Elixir standard library\u0026apos;s Version module allows an attacker who controls a version string to cause a denial of service through CPU and memory exhaustion.\n\nThe version parser converts numeric version components (major, minor, patch and numeric pre-release/build identifiers) to integers without bounding their length. A single large all-digit component therefore forces a super-linear, non-yielding base-10 to arbitrary-precision integer conversion (String.to_integer/1, i.e. :erlang.binary_to_integer/1) that pins a BEAM scheduler, and a larger component raises an uncaught SystemLimitError that crashes the calling process. A single moderately sized string (around one megabyte) is enough; no authentication is required.\n\nThis is reachable from the public entry points Version.parse/1, Version.parse!/1, Version.match?/3, Version.compare/2, and Version.parse_requirement/1, which applications routinely call on untrusted input such as HTTP parameters, dependency-manifest fields, and package metadata.\n\nThis vulnerability is associated with program files lib/version.ex and program routines \u0026apos;Elixir.Version.Parser\u0026apos;:parse_digits/2.\n\nThis issue affects Elixir: from 1.5.0 before 1.20.1.(CVE-2026-49762)","status":"published","published":"2026-06-24T11:11:42Z","modified":"2026-08-18T01:21:12.252343562Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"UBUNTU-CVE-2026-49762","description":"Uncontrolled Resource Consumption vulnerability in the Elixir standard library's Version module allows an attacker who controls a version string to cause a denial of service through CPU and memory exhaustion. The version parser converts numeric version components (major, minor, patch and numeric pre-release/build identifiers) to integers without bounding their length. A single large all-digit component therefore forces a super-linear, non-yielding base-10 to arbitrary-precision integer conversion (String.to_integer/1, i.e. :erlang.binary_to_integer/1) that pins a BEAM scheduler, and a larger component raises an uncaught SystemLimitError that crashes the calling process. A single moderately sized string (around one megabyte) is enough; no authentication is required. This is reachable from the public entry points Version.parse/1, Version.parse!/1, Version.match?/3, Version.compare/2, and Version.parse_requirement/1, which applications routinely call on untrusted input such as HTTP parameters, dependency-manifest fields, and package metadata. This vulnerability is associated with program files lib/version.ex and program routines 'Elixir.Version.Parser':parse_digits/2. This issue affects elixir: from 0.9.3 before 1.20.1.","status":"published","published":"2026-06-09T14:16:00Z","modified":"2026-10-17T12:58:58.286981238Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:56:33.391918Z"},{"id":"AZL-89672","title":"CVE-2026-49762 affecting package elixir for versions less than 1.16.1-2","description":"Uncontrolled Resource Consumption vulnerability in the Elixir standard library's Version module allows an attacker who controls a version string to cause a denial of service through CPU and memory exhaustion.\n\nThe version parser converts numeric version components (major, minor, patch and numeric pre-release/build identifiers) to integers without bounding their length. A single large all-digit component therefore forces a super-linear, non-yielding base-10 to arbitrary-precision integer conversion (String.to_integer/1, i.e. :erlang.binary_to_integer/1) that pins a BEAM scheduler, and a larger component raises an uncaught SystemLimitError that crashes the calling process. A single moderately sized string (around one megabyte) is enough; no authentication is required.\n\nThis is reachable from the public entry points Version.parse/1, Version.parse!/1, Version.match?/3, Version.compare/2, and Version.parse_requirement/1, which applications routinely call on untrusted input such as HTTP parameters, dependency-manifest fields, and package metadata.\n\nThis vulnerability is associated with program files lib/version.ex and program routines 'Elixir.Version.Parser':parse_digits/2.\n\nThis issue affects elixir: from 0.9.3 before 1.20.1.","status":"published","published":"2026-06-09T14:16:44Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:25.633663Z"}]}}